kernel BUG at mm/mmap.c:1990

8< (snip)

I posted a reduced testcase to trigger this several months ago, if that would be useful to you. I don't have it handy, though.

Jeff Bailey - http://www.raspberryginger.com/jbailey/

iirc this only bites on 32bit kernels.

This is what Jeff is referring to:

/*
* Testcase reduced from ltp, adjtimex02
*
* 1) adjtimex(2) fails with errno set to EFAULT if buf does
* not point to writable memory
*/

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/timex.h>

int
main()

{
	int x;
	struct timex *buffp = (struct timex *) -1;

	/* Check whether we are root */
	if (geteuid() != 0) {
		fprintf(stderr, "This needs to run as root.\n");
		return(-1);
	}
	
	/* Call adjtimex(2) */
	x = adjtimex(buffp);

	return x;
}

_______________________________________________
parisc-linux mailing list
[email protected]
http://lists.parisc-linux.org/mailman/listinfo/parisc-linux

The following patch is a first draft which fixes the LTP crashes. It still includes debugging info... I assume the main problem is, that get_user() and put_user() does not do any memory region checking at all. I think this is wrong (although the fault handler may have catched most of the wrong ones).

I know my implementation of the function access_ok() is wrong.
I tried and looked at the other arch implementations, but I didn't found an easy one. But I'm sure there is one, and hopefully someone here can point me to a better/correct implementation...?

Comments ?

Helge

index 5575e41..cd8b657 100644
@@ -488,20 +488,30 @@ handle_store_error:
 #ifdef __KERNEL__
 unsigned long copy_to_user(void __user *dst, const void *src, unsigned long len)
 {
-	mtsp(get_kernel_space(), 1);
-	mtsp(get_user_space(), 2);
-	return pa_memcpy((void __force *)dst, src, len);
+	BUG_ON((long) len < 0);
+	if (access_ok(VERIFY_WRITE, dst, len)) {
+		mtsp(get_kernel_space(), 1);
+		mtsp(get_user_space(), 2);
+		len = pa_memcpy((void __force *)dst, src, len);
+	};
+	return len;
 }
 
 unsigned long copy_from_user(void *dst, const void __user *src, unsigned long len)
 {
-	mtsp(get_user_space(), 1);
-	mtsp(get_kernel_space(), 2);
-	return pa_memcpy(dst, (void __force *)src, len);
+	BUG_ON((long) len < 0);
+	if (access_ok(VERIFY_READ, src, len)) {
+		mtsp(get_user_space(), 1);
+		mtsp(get_kernel_space(), 2);
+		len = pa_memcpy(dst, (void __force *)src, len);
+	} else
+		memset(dst, 0, len);
+	return len;
 }
 
 unsigned long copy_in_user(void __user *dst, const void __user *src, unsigned long len)
 {
+	BUG_ON((long) len < 0);
 	mtsp(get_user_space(), 1);
 	mtsp(get_user_space(), 2);
 	return pa_memcpy((void __force *)dst, (void __force *)src, len);

_______________________________________________
parisc-linux mailing list
[email protected]
http://lists.parisc-linux.org/mailman/listinfo/parisc-linux